NEGOMBO, Sri Lanka (AP) — An impatient little girl in a pretty dress pulls on the hand of a man, possibly her grandfather, as they cross a brick courtyard outside St. Sebastian’s Church on Easter Sunday. Directly in her path a slightly built, bearded man, bent beneath the weight of a large backpack, slows down so he doesn’t bump into the girl, his fingers seeming to touch her hair for just an instant as she passes.

And then, CCTV cameras show, they both go about their day, the girl continuing across the courtyard, the man with the pack marching with purpose toward the main church building — a common, almost mundane interaction made chilling only by what happens next.

The man walks into the church packed with worshippers, a ceiling fan whirring above, and, according to authorities, detonates the bomb in his bag, part of a coordinated set of attacks on churches and luxury hotels across Sri Lanka that killed more than 250 people. Officials are now hunting for clues that might explain how a little-known Islamic radical group went from defacing Buddhist statues and posting online screeds to pulling off one of the most stunning and brutal attacks in recent years.

From a copper factory outside Colombo, the capital, where the bombs may have been put together, to a respected spice merchant’s luxury compound in the city where his two wealthy, radicalized sons reportedly planned their parts in the bombings, to a hothead mastermind who seems to have sharpened his building hatred with help from the Islamic State group — a picture of a determined local militant cell that suddenly went global is slowly emerging from the immediate aftermath of grief and confusion. The details are from Sri Lankan authorities speaking to The Associated Press and local media, and from video of the attacks.

As the bombers’ motivations and backgrounds come into focus, Sri Lanka, which dealt with homegrown terror of a much different sort during a nearly three-decade civil war, is struggling to understand how a sliver of local Muslims broke off from what had been a relatively inclusive form of the religion for years and apparently joined an international militant network whose brand is mass murder on a spectacular scale.

___

THE SPICE BROTHERS

It doesn’t look much like a militant lair: The three-story villa’s smooth, well-maintained exterior rises up behind a solid white wall in a quiet, leafy neighborhood, wood-framed glass doors opening up on spacious balconies flanked by pillars, a BMW parked outside.

But it was inside this home that the sons of a wealthy, well-connected — and now arrested — pepper and cinnamon merchant, Mohammad Yusuf Ibrahim, may have planned their deadly parts in the bombings. And it was here that, as the police closed in after the men’s alleged suicide attacks, the wife of one of the brothers reportedly blew up herself, her children and several police officers.

At a copper factory that has been linked in local media to the family, conspirators may have packed scraps of metal into the bombs used in the attacks.

Some of the attackers reportedly worked out at a local gym ahead of the attacks. They played soccer. They bought a car in a suburb of Colombo.

The developing portrait of the attackers is both maddeningly incomplete and unsettling. These men appeared to be well-educated — one, for instance, reportedly studied in the United Kingdom and Australia — well-connected, with apparent links in some cases to the nation’s business and political elite, and financially stable.

So how could some of Sri Lanka’s most well-off citizens fall prey to virulent extremism?

He stands in a long black robe, surrounded by other purported bombers, the only one with his face uncovered by a scarf. Clutching an assault rifle in one hand, he lifts the index finger of the other in an apparent militant salute and pledges allegiance to the Islamic State group, which distributed the video it says shows the attackers it had sponsored.

The man appears to be Mohamed Zahran, who officials say was the attackers’ ringleader, and who was only recently confirmed by officials to have died in one of the suicide missions.

Zahran has been affiliated with a group called National Towheed Jamaat, which has been known for several years because of his incendiary online speeches lashing out against all non-Muslims and calling for their elimination. The group has also reportedly vandalized Buddhist statues.

In 2014, a group that called itself the “Peace Loving Moderate Muslims in Sri Lanka” published a newspaper commentary that said National Towheed Jamaat was “fast becoming a cancer” within Sri Lanka’s Muslim community and warned that the group was making mosque attendance compulsory, forcing a strict implementation of Islamic law and making women cover their faces and wear long robes.

___

THE OUTSIDE HELP

Easter Sunday again. Another CCTV camera, another man carrying a too-large backpack. This time at a luxury hotel. He enters the restaurant and pauses, awkwardly, among the tables.

The world has zeroed in on what officials say happens next — the carnage and the misery — but police have been trying to answer another very specific mystery: How did this tiny, little-known Sri Lankan group suddenly orchestrate a large-scale, nearly simultaneous suicide bombing attack against busy churches and hotels across the country?

The right people had to be recruited and trained in bomb-making. Safe houses had to be found, the targets scouted. Someone had to make sure the bombers got where they needed without blowing themselves up at the wrong time or getting stopped by police.

It is the kind of sophisticated operation that strongly points to local extremists being groomed by foreigners.

The choice of targets — Christians and foreigners — also suggests outside assistance. A strictly homegrown Islamic extremist attack would have likely targeted majority Buddhists because of anger over ultranationalist mob attacks on Muslims in past years.

The Islamic State group claimed quick responsibility for the attack. Australian Prime Minister Scott Morrison announced later that there was confirmation that the attackers were supported by the group.

Police say the attackers got some of their weapons training overseas, and Sri Lankan President Maithripala Sirisena said some 140 people in Sri Lanka have been identified as having links to IS.

“This is another experience for us. Not that we are strangers to terrorism, but this is global terrorism, so we have to ensure that we root this out,” Prime Minister Wickremesinghe said.

___

THE SEEDS OF HATE

The Easter bombings may have seemed sudden, but experts point to a long period of gradual radicalization among some Sri Lankan Muslims.

Muslims in the country were once a “model community” that supported the government in the fight against the Tamil Tiger rebels in the civil war that ended in 2009, terrorism expert Rohan Gunaratna said. It was only after the 2001 attacks in the United States and the subsequent U.S. invasion of Iraq, he said, that radical preachers began coming to Sri Lanka, often from Saudi Arabia and Pakistan, and extremists began more regularly posting online hate.

“This type of Islam started to replace the local and traditional type, which is a very beautiful form of Islam because it accommodated other religions. There had been space for other religious groups to operate, but the type that came from the Middle East was very hard line, more political, more anti-Western,” he said.